Privacy Policy — Noctrodex (SafeGuard India)

Effective Date: August 18, 2026
Operator: Noctrodex (OPC) PRIVATE LIMITED
App Name: Noctrodex (SafeGuard India)

1. Overview & Privacy Principles

Noctrodex ("SafeGuard India") is committed to protecting your privacy while defending your device against financial fraud, phishing links, caller impersonation, and cyber scam campaigns. We strictly adhere to the Digital Personal Data Protection Act (DPDP Act 2023) and Google Play Developer Policies.

No Message Storage On Our Servers: Message bodies are never written to our databases.
On-Device Rules, With Named Cloudflare Flows: Core rules and heuristics run on your phone. The text of a message you check is sent over an encrypted connection to our own Cloudflare server for fraud classification, then discarded as soon as the verdict is returned. Optional phonebook caller ID sends contact names and phone numbers only after you separately enable that setting.
Optional Phonebook Caller ID: Your contacts are read on the device by default. If you turn on "Help identify callers from contacts", saved contact names and phone numbers are uploaded to our Cloudflare backend for community caller ID after a separate in-app disclosure and consent.
Call Recordings Stay On Your Phone: Recordings are created only when you tap Record, are kept in the app's private storage, and are never uploaded.
Pseudonymous Crowdsourced Reporting: Reports transmit only the scammer's identifier (number, sender ID or link) and a random per-install ID, never your identity.
Full Data Erasure: Delete all on-device data from the in-app Privacy Center, withdraw optional phonebook sharing, or delete your account entirely, at any time.

2. Sensitive Permissions & Purpose

Permission	Purpose	Data Handling
Default SMS Handler	Core SMS and MMS messaging, reply delivery, and scam detection.	Messages stay in your device's SMS/MMS database. On-device rules run locally; the text of a message being checked is sent to our server for classification and discarded after the verdict.
Default Phone App & In-Call Screen	Keypad, call log, contacts and the in-call fraud assessment.	Call log stays on the device. Contacts stay on the device unless you separately enable phonebook caller ID, which uploads contact names and phone numbers for community caller identification.
Optional Phonebook Caller ID	Community caller names for numbers not in your own contacts.	Off by default. If enabled, contact names and phone numbers are processed on Cloudflare. Phone numbers are stored in D1 as server-side HMAC keys; names show to other users only after multiple consenting users submit the same name for the same number. Vectorize may retrieve approved fraud guidance for explanations, but raw phonebook rows are not embedded. You can withdraw consent anytime.
Call Screening Service	Screening incoming calls against numbers other users reported for fraud.	Only the incoming number is checked against community rollups.
Microphone	In-call recording, started only when you tap Record.	Saved to the app's private storage on your device. Never uploaded. Note that from Android 10 the system restricts call-audio capture for apps that are not preinstalled, so a recording may contain only your own side of the call.
Notifications	Delivering incoming messages and urgent fraud warnings.	Generated on the device.

3. Data Deletion & DPDP Rights

Under the DPDP Act 2023 you can, at any time:

Delete all my data (Settings → Privacy & my data) purges local scan history, the queued report queue, app-lock settings and call recordings, keeping your account.
Delete my account removes your account, sessions, subscription record and optional phonebook caller-ID contributions from our servers immediately. See the account deletion page for exactly what is deleted and what is kept.
Withdraw phonebook caller-ID consent, which deletes your uploaded contact contributions from the backend.
Withdraw reporting consent, which deletes any queued reports straight away.

4. Official Compliance URLs

Google Play Privacy Policy URL: https://safeguard-india-reports.soumabha-majumdar.workers.dev/privacy
Google Play Account Deletion URL: https://safeguard-india-reports.soumabha-majumdar.workers.dev/delete-account

Data Protection Officer: soumabha@noctrodex-hq.com. Verified requests are completed within 30 days.